# CVE-2026-123372: compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings

Status: published. Published: 2026-11-09. Updated: 2026-11-13.

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0.

## Remediation

- fix: compose-lint (pip): GitHub reports patched versions 0.32.0. Check the advisory for the affected release branch. (source: GitHub GHSA-jf3h-8jvx-vcrg) — https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg
- fix: tmatens/compose-lint (actions): GitHub reports patched versions 0.32.0. Check the advisory for the affected release branch. (source: GitHub GHSA-jf3h-8jvx-vcrg) — https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg
- fix: compose-lint (PyPI): OSV reports a fixed version 0.32.0. Check the advisory for supported release branches. (source: OSV GHSA-jf3h-8jvx-vcrg) — https://github.com/advisories/GHSA-jf3h-8jvx-vcrg
- fix: tmatens/compose-lint (GitHub Actions): OSV reports a fixed version 0.32.0. Check the advisory for supported release branches. (source: OSV GHSA-jf3h-8jvx-vcrg) — https://github.com/advisories/GHSA-jf3h-8jvx-vcrg
- fix: tmatens/compose-lint: OSV reports a fix at commit 2d42617e4c6416f797bbfc6a057950131fa02df3. (source: OSV GHSA-jf3h-8jvx-vcrg) — https://github.com/advisories/GHSA-jf3h-8jvx-vcrg

## Affected products and versions

- tmatens / compose-lint: >= 0.22.0, < 0.32.0 (affected). Source: CNA: GitHub_M
-  / compose-lint (compose-lint): >= 0.22.0, <= 0.31.0 (affected, GitHub advisory range). Source: GitHub GHSA-jf3h-8jvx-vcrg
-  / tmatens/compose-lint (tmatens/compose-lint): >= 0.22.0, <= 0.31.0 (affected, GitHub advisory range). Source: GitHub GHSA-jf3h-8jvx-vcrg
-  / compose-lint (compose-lint): 0.22.0 (affected, PyPI); 0.23.0 (affected, PyPI); 0.24.0 (affected, PyPI); 0.25.0 (affected, PyPI); 0.26.0 (affected, PyPI); 0.27.0 (affected, PyPI); 0.28.0 (affected, PyPI); 0.29.0 (affected, PyPI); 0.30.0 (affected, PyPI); 0.31.0 (affected, PyPI); Ecosystem version events: introduced 0.22.0; fixed 0.32.0. Source: OSV GHSA-jf3h-8jvx-vcrg
-  / tmatens/compose-lint (tmatens/compose-lint): v0.31.0 (affected, GitHub Actions); v0.30.0 (affected, GitHub Actions); v0.29.0 (affected, GitHub Actions); v0.28.0 (affected, GitHub Actions); v0.27.0 (affected, GitHub Actions); v0.26.0 (affected, GitHub Actions); v0.25.0 (affected, GitHub Actions); v0.24.0 (affected, GitHub Actions); v0.23.0 (affected, GitHub Actions); v0.22.0 (affected, GitHub Actions); Ecosystem version events: introduced 0.22.0; fixed 0.32.0; Git commit history: introduced 811ef6b379dbc78d048fcedaf976205705d4a7c3; fixed 2d42617e4c6416f797bbfc6a057950131fa02df3. Source: OSV GHSA-jf3h-8jvx-vcrg

## Severity and prioritization

- CVSS 4.0: 2.3 (low); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: GitHub_M

- CVSS 4.0: 2.3 (low); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: security-advisories@github.com

- CISA KEV: No listing in collected sources

- EPSS: 0.38% as of 2026-11-12; percentile 32.50%

- SSVC: exploitation poc; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-200, CWE-532

## Exploit evidence

- exploit: https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg (ADP: CISA-ADP)

## References

- https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/tmatens/compose-lint/pull/944 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/tmatens/compose-lint/releases/tag/v0.32.0 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg (ADP: CISA-ADP; exploit)

- https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2 (security-advisories@github.com)

- https://github.com/tmatens/compose-lint/pull/944 (security-advisories@github.com)

- https://github.com/tmatens/compose-lint/releases/tag/v0.32.0 (security-advisories@github.com)

- https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg (security-advisories@github.com)

- https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg (GitHub Security Advisories; advisory)

- https://github.com/advisories/GHSA-jf3h-8jvx-vcrg (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-jf3h-8jvx-vcrg (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-123372; retrieved 2026-11-13; source updated 2026-11-13

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-123372; retrieved 2026-11-13; source updated 2026-11-12

- GitHub Security Advisories: https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg; retrieved 2026-11-12; source updated 2026-11-10

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-jf3h-8jvx-vcrg; retrieved 2026-11-13; source updated 2026-11-10

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-123372; retrieved 2026-11-13; source updated Not reported

Revision: 190a87391b800de56f979dae882266fe9f91c6263336fc69efc5e8b07f12b60e

Canonical: https://y2.dev/cve/CVE-2026-123372

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.